A phishing email used to announce itself. Broken grammar, a strange sender, a link to a domain nobody recognised. Those messages still land in inboxes, but they are rarely the ones that cause damage. The campaigns that work now borrow tools your organisation already trusts: file-sharing platforms, e-signature services, payroll portals, cloud document previews. They arrive on a Tuesday morning with a request that sounds almost reasonable. Teaching people to spot bad writing is no longer a control. Teaching them to spot pressure, unusual asks and off-channel requests is.

What changed, and why the old advice is thin

Most phishing today runs on legitimate infrastructure. A fake invoice may sit behind a real file-sharing domain that your email filter has no reason to block. The sender name matches a colleague you know. The message references a real project, a real supplier, a real deadline, because that information is often public: job titles on a company page, an out-of-office reply, a press release, an annual report.

There is nothing to catch in the spelling. The tell is in the ask, the timing and the channel. That is a much harder thing to teach, but it is also a more durable lesson, because the same instincts cover phone calls, text messages and messaging apps.

The seven red flags worth teaching

1. Urgency with a deadline you did not set

Phishing depends on speed. A message that says the payment must clear today, the account will be suspended in two hours, or the contract expires at five is trying to remove your thinking time. Legitimate business does contain urgency, which is what makes this flag tricky. The rule to teach is not "ignore urgent messages" but "never let urgency replace verification." Slow down, then check through another route.

2. A request to move to another channel

Watch for a message that quickly tries to relocate. "Reply to my personal address, my work email is acting up." "Text me on this number." "Add me on a messaging app." Each move takes the conversation somewhere your security tools cannot see and where identity is easier to fake. If a colleague or supplier suddenly wants to switch channels mid-thread, confirm the change with them directly.

3. Any request for credentials, codes or payment details

Treat every request for a password, a one-time code, a multi-factor prompt or a change of bank details as hostile until proven otherwise. No legitimate IT desk, bank or service provider needs your one-time code, and repeating that line matters. If a payment change is requested, verify it by phone using a number from your own records, not the number printed in the message.

4. A sender that does not quite match

Display names are free to fake. Teach people to look at the actual address, not the friendly label above it. On a phone, tap the name to reveal the full address. Check whether the reply-to address differs from the sender, whether the domain is a near-miss of a known one, and whether an internal-sounding message really came from inside the company. A message from "Accounts Payable" sent from a personal mailbox is a flag on its own.

5. Links, attachments and QR codes that lead to a login page

Any message that pushes you towards a sign-in screen deserves a pause. Rather than clicking, open the service the way you normally do, from a bookmark or by typing the address. On mobile, press and hold a link to preview where it goes. A QR code in an email does the same job as a link while hiding the destination, and scanners on personal phones rarely warn you. Attachments that ask you to enable macros or sign in again fall into the same bucket.

6. A familiar name, but an unfamiliar pattern

Your CFO does not usually email you at 21:40 about a confidential transfer. A supplier's project manager does not suddenly write in a different register, with different greetings, or from a shorter signature block. Thread hijacking is common: an attacker inserts a new reply into an existing conversation. When a known contact behaves in an unknown way, that inconsistency is the signal.

7. Flattery, fear or a favour

Social engineering leans on emotion. A compliment on your responsiveness, a warning about a disciplinary matter, a small favour asked quietly and confidentially. The common thread is that it isolates you: don't tell anyone, handle this personally, I'll explain later. Any request that includes secrecy is a request to skip verification.

A checklist staff can keep on one card

1. Stop. Do not reply, click, scan or forward. Nothing bad happens from waiting ten minutes.
2. Verify out of band. Call or message the person using contact details you already have, not the ones in the message.
3. Reach the site your own way. Type the address or use a bookmark instead of following the link.
4. Never share codes. Passwords and one-time codes stay with you, no exceptions, no matter who asks.
5. Confirm money aloud. New bank details or a rushed payment get a phone call to a known number.
6. Report it. Send it to the security team, even if you are unsure, and even if you already clicked.

Print that list, put it in the onboarding pack, and repeat it in team meetings. Familiarity is what makes it work at 17:00 on a Friday.

How to make the training stick

One annual slide deck changes nothing. Short, frequent practice does. Pick one flag each month, send a two-line reminder, and include a real example that has been stripped of identifying details. Run occasional simulations that are realistic rather than theatrical: an internal-looking note from a manager, a shared document notification, a delivery message. Track how many people report the simulation, not just how many fail it.

Reporting must be rewarded. If the first response to a mistake is blame, people will quietly delete suspicious messages and hope. Make the report button easy to find, acknowledge every report, and thank people for the false alarms. A false alarm costs a few minutes; an unreported click can cost a week.

Make reporting the path of least resistance

Your employees are not the weak link. They are the sensor network, and sensors need a fast, safe route back to the people who can act. Give them one obvious reporting button, a promise of a quick reply, and a clear recovery process if something was clicked: change the password, tell IT immediately, watch for unexpected sign-in or multi-factor prompts, and check for forwarding rules added to the mailbox.

Then keep saying the important part out loud, in plain language: you will never be in trouble for reporting something you were not sure about. That single sentence, repeated honestly, will catch more attacks than any filter.

Photo: cottonbro studio / Pexels